Upgrade gs-9.25 -> gs-9.26

git-svn-id: svn://tug.org/texlive/trunk@49215 c570f23f-e606-0410-a88d-b1316a301751

26 files changed, 542 insertions, 333 deletions

diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_cff.ps b/Master/tlpkg/tlgs/Resource/Init/gs_cff.ps
index 20c35a5f690..b60e3740572 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_cff.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_cff.ps
@@ -199,7 +199,7 @@ def
 % ordinary CFF font.
 /StartData {          % <resname> <nbytes> StartData -
   currentfile exch subfilefilter //false //false ReadData pop
-} bind def
+} bind executeonly def
 /ReadData {           % <resname> <file> <forceresname> <forcecid> ReadData <fontset>
         % Initialize.
 
@@ -234,7 +234,7 @@ def
   end		% FontSetInit ProcSet
   /FontSet defineresource
 
-} bind def
+} bind executeonly def
 
 % ---------------- Resource category definition ---------------- %
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_cidcm.ps b/Master/tlpkg/tlgs/Resource/Init/gs_cidcm.ps
index 0201ea8902b..60b0fdb2971 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_cidcm.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_cidcm.ps
@@ -327,7 +327,7 @@ currentdict end def
       //FindResource exec
     } ifelse
   } ifelse
-} bind def
+} bind executeonly def
 
 /ResourceStatus {  % <InstName> ResourceStatus <nStatus> <nSize> true
                    % <InstName> ResourceStatus false
@@ -359,7 +359,7 @@ currentdict end def
       //false
     } ifelse
   } ifelse
-} bind def
+} bind executeonly def
 
 /ResourceForAll { % <template> <proc> <scratch> ResourceForAll -
 
@@ -440,7 +440,7 @@ currentdict end def
 
   % Make the enumerator and apply it :
   /MappedCategoryRedefiner /ProcSet findresource /MakeResourceEnumerator get exec exec
-} bind def
+} bind executeonly def
 
 currentdict end /Font exch /Category defineresource pop
 end
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_ciddc.ps b/Master/tlpkg/tlgs/Resource/Init/gs_ciddc.ps
index 54c68766606..f83e960b129 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_ciddc.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_ciddc.ps
@@ -204,7 +204,7 @@ begin
     exch pop begin                                   %
     .GetCIDDecoding
     end
-  } bind def
+  } bind executeonly def
 
   /FindResource      % <name> FindResource <dict>
   { currentglobal exch                               % bGlobal /InstName
@@ -212,7 +212,7 @@ begin
     dup //.MakeInstance exec                         % bGlobal /InstName <Inst>
     DefineResource                                   % bGlobal <Inst>
     exch setglobal                                   % <Inst>
-  } bind def
+  } bind executeonly def
 
 currentdict end
 /CIDDecoding exch /Category defineresource pop
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_cmap.ps b/Master/tlpkg/tlgs/Resource/Init/gs_cmap.ps
index 63c023b6753..a01afc23feb 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_cmap.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_cmap.ps
@@ -536,7 +536,7 @@ dup /DefineResource {
   } if
   dup /CodeMap .knownget { //null eq { .buildcmap } if } if
   /Generic /Category findresource /DefineResource get exec
-} bind put
+} bind executeonly put
 /Category defineresource pop
         % We might have loaded CID font support already.
 /CIDInit /ProcSet 2 copy { findresource } .internalstopped
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_diskn.ps b/Master/tlpkg/tlgs/Resource/Init/gs_diskn.ps
index 5540715dcff..fd694bc44b5 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_diskn.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_diskn.ps
@@ -53,7 +53,7 @@ systemdict begin
     exch .setglobal
   }
   if
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 % Modify .putdevparams to force regeneration of .searchabledevs list
 /.putdevparams {
@@ -61,7 +61,7 @@ systemdict begin
   % doesn't get run enough to justify the complication
   //.putdevparams
   //systemdict /.searchabledevs .forceundef
-} .bind odef % must be bound and hidden for .forceundef
+} .bind executeonly odef % must be bound and hidden for .forceundef
 
 % ------ extend filenameforall to handle wildcards in %dev% part of pattern -------%
 /filenameforall {
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_dps.ps b/Master/tlpkg/tlgs/Resource/Init/gs_dps.ps
index cad7056230d..00c14d53204 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_dps.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_dps.ps
@@ -70,7 +70,7 @@
                 % Save a copy of the initial gstate.
   //systemdict /savedinitialgstate gstate readonly .forceput
   .setglobal
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 % Initialize local dictionaries and gstate when creating a new context.
 % Note that until this completes, we are in the anomalous situation of
@@ -124,7 +124,7 @@
   /savedinitialgstate .systemvar setgstate gsave
                 % Wrap up.
   end .setglobal
-} odef
+} bind executeonly odef
 
 % Check whether an object is a procedure.
 /.proccheck {			% <obj> .proccheck <bool>
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_dps1.ps b/Master/tlpkg/tlgs/Resource/Init/gs_dps1.ps
index 1182f53e61e..ec5db61b9f0 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_dps1.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_dps1.ps
@@ -21,7 +21,7 @@ level2dict begin
 % ------ Virtual memory ------ %
 
 /currentshared /.currentglobal load def
-/scheck /.gcheck load def
+/scheck {.gcheck} bind odef
 %****** FOLLOWING IS WRONG ******
 /shareddict currentdict /globaldict .knownget not { 20 dict } if def
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_epsf.ps b/Master/tlpkg/tlgs/Resource/Init/gs_epsf.ps
index e4037d9b53c..2d0f6774716 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_epsf.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_epsf.ps
@@ -31,7 +31,7 @@
 /EPSBoundingBoxState 5 def
 /EPSBoundingBoxSetState {
   //systemdict /EPSBoundingBoxState 3 -1 roll .forceput
-} .bind odef % .forceput must be bound and hidden
+} .bind executeonly odef % .forceput must be bound and hidden
 
 % Parse 4 numbers for a bounding box
 /EPSBoundingBoxParse { % (llx lly urx ury) -- llx lly urx ury true OR false
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_fapi.ps b/Master/tlpkg/tlgs/Resource/Init/gs_fapi.ps
index deb6b3e19e1..ac3c27d299b 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_fapi.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_fapi.ps
@@ -455,6 +455,9 @@ bind def
 end % the temporary dictionary for local binding.
 odef odef odef odef odef odef
 
+% Undef these, not needed outside this file
+[ /.FAPIavailable /.FAPIpassfont /.FAPIrebuildfont ] {systemdict exch .forceundef} forall
+
 .setlanguagelevel
 
 %END FAPI
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_fntem.ps b/Master/tlpkg/tlgs/Resource/Init/gs_fntem.ps
index 3ceee18d396..c1f7651f18c 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_fntem.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_fntem.ps
@@ -408,7 +408,7 @@ currentdict end def
     exit
   } loop
   exch setglobal
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 currentdict end /ProcSet defineresource pop
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_fonts.ps b/Master/tlpkg/tlgs/Resource/Init/gs_fonts.ps
index 38f0f6ca26f..803faca4918 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_fonts.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_fonts.ps
@@ -372,8 +372,12 @@ FONTPATH length 0 eq { (%END FONTPATH) .skipeof } if
 % of strings: what the system thinks is the ps name,
 % and the access path.
 /.setnativefontmapbuilt { % set whether we've been run
-  systemdict exch /.nativefontmapbuilt exch .forceput
-} .bind executeonly def
+  dup type /booleantype eq {
+      systemdict exch /.nativefontmapbuilt exch .forceput
+  }
+  {pop}
+  ifelse
+} .bind executeonly odef
 systemdict /NONATIVEFONTMAP known .setnativefontmapbuilt
 /.buildnativefontmap {   % - .buildnativefontmap <bool>
   systemdict /.nativefontmapbuilt .knownget not
@@ -418,6 +422,7 @@ systemdict /NONATIVEFONTMAP known .setnativefontmapbuilt
     //true .setnativefontmapbuilt
   } ifelse
 } bind def
+currentdict /.setnativefontmapbuilt .forceundef
 
 % Create the dictionary that registers the .buildfont procedure
 % (called by definefont) for each FontType.
@@ -578,7 +583,7 @@ buildfontdict 3 /.buildfont3 cvx put
 } bind def
 /.setloadingfont {
    //systemdict /.loadingfont 3 -1 roll .forceput
-} .bind odef % .forceput must be bound and hidden
+} .bind executeonly odef % .forceput must be bound and hidden
 /.loadfont
  {              % Some buggy fonts leave extra junk on the stack,
                 % so we have to make a closure that records the stack depth
@@ -1007,7 +1012,7 @@ $error /SubstituteFont { } put
     dup length string copy
     .forceput setglobal
   } ifelse
-} .bind odef % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 % Attempt to load a font from a file.
 /.tryloadfont {         % <fontname> .tryloadfont <font> true
@@ -1098,7 +1103,7 @@ $error /SubstituteFont { } put
 
                 % Check to make sure the font was actually loaded.
         dup 3 index .fontknownget
-         { dup /PathLoad 4 index //.putgstringcopy exec
+         { dup /PathLoad 4 index .putgstringcopy
            4 1 roll pop pop pop //true exit
          } if
 
@@ -1110,7 +1115,7 @@ $error /SubstituteFont { } put
          {            % Stack: origfontname fontdirectory path filefontname
            2 index 1 index .fontknownget
             {   % Yes.  Stack: origfontname fontdirectory path filefontname fontdict
-              dup 4 -1 roll /PathLoad exch //.putgstringcopy exec
+              dup 4 -1 roll /PathLoad exch .putgstringcopy
                       % Stack: origfontname fontdirectory filefontname fontdict
               3 -1 roll pop
                       % Stack: origfontname filefontname fontdict
@@ -1143,7 +1148,7 @@ $error /SubstituteFont { } put
 
     } loop              % end of loop
 
- } bind executeonly def % must be bound and hidden for .putgstringcopy
+ } bind executeonly odef % must be bound and hidden for .putgstringcopy
 
 currentdict /.putgstringcopy .undef
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_init.ps b/Master/tlpkg/tlgs/Resource/Init/gs_init.ps
index bec307d1b13..d733124b96d 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_init.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_init.ps
@@ -20,6 +20,11 @@
 %	%% Replace <n> <file(s)>
 % indicate places where the next <n> lines should be replaced by
 % the contents of <file(s)>, when creating a single merged init file.
+%
+% For reasons not clear to me, some cases of %% are being treated as
+% DSC comments when (and only when) the resource files are disk based
+% This can kill DSC parsing for pdfwrite at least, so avoid using
+% double % comments in this file.
 
 % The interpreter can call out to PostScript code.  All procedures
 % called in this way, and no other procedures defined in these
@@ -29,7 +34,7 @@
 % Interpreter library version number
 % NOTE: the interpreter code requires that the first non-comment token
 % in this file be an integer, and that it match the compiled-in version!
-925
+926
 
 % Check the interpreter revision.
 dup revision ne
@@ -136,12 +141,12 @@ currentdict /PDFNOCIDFALLBACK known /PDFNOCIDFALLBACK exch def
          ifelse
   .bind def
 
-%% This was a debugging switch removed in 9.22, no other software
-%% should have had any regard for it, and even if testing its value
-%% should have checked its existence first. However pstotext, an
-%% ancient and no longer maintained piece of softare, did check
-%% its value unconditionally. So we retain this key in the dictionary
-%% purely for backward compatibility.
+% This was a debugging switch removed in 9.22, no other software
+% should have had any regard for it, and even if testing its value
+% should have checked its existence first. However pstotext, an
+% ancient and no longer maintained piece of softare, did check
+% its value unconditionally. So we retain this key in the dictionary
+% purely for backward compatibility.
 /NOBIND false def
 
 currentdict /BATCH known   /BATCH exch def
@@ -188,6 +193,16 @@ currentdict /DELAYSAFER known { /DELAYSAFER //true def /NOSAFER //true def } if
   currentdict /PARANOIDSAFER known or	% PARANOIDSAFER is equivalent
 }
 ifelse def
+
+/SAFERERRORS
+currentdict /NOSAFERERRORS known
+{
+  //false
+}
+{
+  currentdict /SAFERERRORS known
+} ifelse def
+
 currentdict /SHORTERRORS known   /SHORTERRORS exch def
 currentdict /TTYPAUSE known   /TTYPAUSE exch def
 currentdict /WRITESYSTEMDICT known   /WRITESYSTEMDICT exch def
@@ -831,12 +846,26 @@ userdict /.currentresourcefile //null put
 /.runstring {
   0 0 .systemvmstring .systemvmSFD cvx { .runexec } execute0
 } bind def
+
 % Define the procedure that the C code uses to set up for executing
 % a string that may be received in pieces.
+%
+% Immediate evaluation doesn't work on operators (like .needinput)
+% so calling .runstringbegin will throw an undefined error if we
+% undefined .needinput so it cannot be accessed outside the init
+% code. But, we can store the operator in an array, use immediate
+% evaluation on the array to get the operator, then undefined the
+% array (and because they are both of the same name, the operator
+% get undefined too).
+% This prevents random Postscript from erroneously calling .needinput
+% and forcing the interpreter into an invalid state.
+/.needinput
+1 .systemvmarray dup 0 /.needinput load put
+def
 /.runstringbegin {
-  1 .systemvmarray dup 0 /.needinput load put cvx	% { .needinput } in systemvm
+  1 .systemvmarray dup 0 //.needinput 0 get put cvx	% { .needinput } in systemvm
   0 0 .systemvmstring .systemvmSFD cvx .runexec
-} bind def
+} bind executeonly def
 
 % Define a special version of runlibfile that aborts on errors.
 /runlibfile0
@@ -1110,8 +1139,7 @@ end
    .setglobal
  } bind def
 ErrorNames
- { dup .registererror /VMerror eq {exit} if
- } forall
+ { .registererror} forall
 errordict begin
 % The handlers for interrupt and timeout are special; there is no
 % 'current object', so they push their own name.
@@ -1123,12 +1151,29 @@ errordict begin
  } bind def
 end		% errordict
 
-% Put all the default handlers in gserrordict
-gserrordict
-errordict {2 index 3 1 roll put} forall
-noaccess pop
-% remove the non-standard errors from errordict
+gserrordict /unknownerror errordict /unknownerror get put
 errordict /unknownerror .undef
+
+/.SAFERERRORLIST ErrorNames def
+/.setsafererrors
+{
+% Put all the requested handlers in gserrordict
+  gserrordict
+  //.SAFERERRORLIST
+  {
+    dup /unknownerror eq
+    {pop}
+    {
+      dup errordict exch get 2 index 3 1 roll put
+    }ifelse
+  }forall
+  noaccess pop
+  systemdict /.setsafeerrors .forceundef
+  systemdict /.SAFERERRORLIST .forceundef
+} bind executeonly odef
+
+SAFERERRORS {.setsafererrors} if
+
 % Define a stable private copy of handleerror that we will always use under
 % JOBSERVER mode.
 /.GShandleerror errordict /handleerror get def
@@ -1760,18 +1805,15 @@ currentdict /.runlibfile .undef
 
 % Bind all the operators defined as procedures.
 /.bindoperators		% binds operators in currentdict
- { % Temporarily disable the typecheck error.
-   errordict /typecheck 2 copy get
-   errordict /typecheck { pop } put	% pop the command
+ {
    currentdict
     { dup type /operatortype eq
-       { % This might be a real operator, so bind might cause a typecheck,
-         % but we've made the error a no-op temporarily.
-         .bind
+       {
+         % This might be a real operator, so bind might cause a typecheck
+         {.bind} .internalstopped pop
        }
       if pop pop
     } forall
-   put
  } def
 DELAYBIND not { .bindoperators } if
 
@@ -2083,12 +2125,12 @@ currentdict /tempfilepaths undef
   //SAFETY /safe //true .forceput % overrides readonly
 } .bind executeonly odef
 
-%% This is only used during startup. Its required so that
-%% we can detect in setpagdevice that we are in fact in startup
-%% and allocate a *global* instead of local VM. We need it to be
-%% global to satisfy Display PostScript (see start of /setpagdevice
-%% in gs_setpd.ps)
-%%
+% This is only used during startup. Its required so that
+% we can detect in setpagdevice that we are in fact in startup
+% and allocate a *global* instead of local VM. We need it to be
+% global to satisfy Display PostScript (see start of /setpagdevice
+% in gs_setpd.ps)
+%
 /.locksafeglobal {
   .locksafe_userparams
   systemdict /getenv {pop //false} put
@@ -2117,8 +2159,8 @@ currentdict /tempfilepaths undef
   .locksafe
 } .bind executeonly odef
 
-%% See /.locksafeglobal above.
-%%
+% See /.locksafeglobal above.
+%
 /.setsafeglobal {
   SAFETY /safe get not {
     <<
@@ -2156,39 +2198,39 @@ SAFER { .setsafeglobal } if
 
 /UndefinePostScriptOperators {
 
-  %% This list is of Display PostScript operators. We believe that Display PostScript
-  %% was never fully implemented and the only known user, GNUStep, is no longer
-  %% using it. So lets remove it.
+  % This list is of Display PostScript operators. We believe that Display PostScript
+  % was never fully implemented and the only known user, GNUStep, is no longer
+  % using it. So lets remove it.
   [
   /condition /currentcontext /detach /.fork /join /.localfork /lock /monitor /notify
   /wait /yield /.currentscreenphase /.setscreenphase /.image2 /eoviewclip /initviewclip
   /viewclip /viewclippath /defineusername
-  %% NeXT DPS extensions
+  % NeXT DPS extensions
   /currentalpha /setalpha /.alphaimage /composite /compositerect /dissolve /sizeimagebox /.sizeimageparams
   ]
   {systemdict exch .forceundef} forall
 
-  %% This list is of operators which no longer appear to be used, and which we do not believe
-  %% to have any real use. For now we will undefine the operstors so they cannot easily be used
-  %% but can be easily restored (just delete the name from the list in the array). In future
-  %% we may remove the operator and the code implementation entirely.
+  % This list is of operators which no longer appear to be used, and which we do not believe
+  % to have any real use. For now we will undefine the operstors so they cannot easily be used
+  % but can be easily restored (just delete the name from the list in the array). In future
+  % we may remove the operator and the code implementation entirely.
   [
-  /.bitadd /.charboxpath /.cond /.countexecstack /.execstack /.runandhide /.popdevicefilter
+  /.bitadd /.charboxpath /.cond /.runandhide /.popdevicefilter
   /.execfile /.filenamesplit /.file_name_parent
   /.setdefaultmatrix /.isprocfilter /.unread /.psstringencode
   /.buildsampledfunction /.isencapfunction /.currentaccuratecurves /.currentcurvejoin /.currentdashadapt /.currentdotlength
   /.currentlimitclamp /.dotorientation /.setaccuratecurves /.setcurvejoin /.setdashadapt /.setdotorientation
   /.setlimitclamp /.currentscreenlevels /.dashpath /.pathbbox /.identeq /.identne /.tokenexec /.forgetsave /.pantonecallback
 
-  %% Used by our own test suite files
-  %%/.setdotlength % Bug687720.ps
+  % Used by our own test suite files
+  %/.setdotlength % Bug687720.ps
   ]
   {systemdict exch .forceundef} forall
 
-  %% This list of operators are used internally by various parts of the Ghostscript startup code.
-  %% Since each operator is a potential security vulnerability, and any operator listed here
-  %% is not required once the initialisation is complete and functions are bound, we undefine
-  %% the ones that aren't needed at runtime.
+  % This list of operators are used internally by various parts of the Ghostscript startup code.
+  % Since each operator is a potential security vulnerability, and any operator listed here
+  % is not required once the initialisation is complete and functions are bound, we undefine
+  % the ones that aren't needed at runtime.
   [
   /.callinstall /.callbeginpage /.callendpage
   /.currentstackprotect /.setstackprotect /.errorexec /.finderrorobject /.installsystemnames /.bosobject /.fontbbox
@@ -2211,7 +2253,8 @@ SAFER { .setsafeglobal } if
   /.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
   /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
   /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
-  /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
+  /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath /.currentoutputdevice
+  /.type /.writecvs /.setSMask /.currentSMask /.needinput /.countexecstack /.execstack /.applypolicies
 
   % Used by a free user in the Library of Congress. Apparently this is used to
   % draw a partial page, which is then filled in by the results of a barcode
@@ -2230,9 +2273,9 @@ SAFER { .setsafeglobal } if
   % test files/utilities, or engineers expressed a desire to keep them visible.
   %
   %/currentdevice /.sort /.buildfont0 /.buildfont1 /.buildfont2 /.buildfont3 /.buildfont4 /.buildfont9 /.buildfont10 /.buildfont11
-  %/.buildfotn32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
+  %/.buildfont32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
   %/currentdevice  /.quit /.setuseciecolor /.needinput /.setoverprintmode /.special_op /.dicttomark /.knownget
-  %/.FAPIavailable /.FAPIpassfont /.FAPIrebuildfont /.FAPIBuildGlyph /.FAPIBuildChar /.FAPIBuildGlyph9
+  %/.FAPIBuildGlyph /.FAPIBuildChar /.FAPIBuildGlyph9
   %/.tempfile /.numicc_components /.set_outputintent  /.max /.min /.vmreclaim /.getpath /.setglobal
   %/.setdebug /.mementolistnewblocks /getenv
   ]
@@ -2242,12 +2285,12 @@ SAFER { .setsafeglobal } if
 } .bind executeonly def % must be bound and hidden for .forceundef
 
 /UndefinePDFOperators {
-  %% This list of operators are used internally by various parts of the Ghostscript PDF interpreter.
-  %% Since each operator is a potential security vulnerability, and any operator listed here
-  %% is not required once the initislisation is complete and functions are bound, we undefine
-  %% the ones that aren't needed at runtime.
-  %% This function is only called if DELAYBIND is true. It is a copy of the code at the end of pdf_main.ps
-  %% and must be maintained in parallel with it.
+  % This list of operators are used internally by various parts of the Ghostscript PDF interpreter.
+  % Since each operator is a potential security vulnerability, and any operator listed here
+  % is not required once the initislisation is complete and functions are bound, we undefine
+  % the ones that aren't needed at runtime.
+  % This function is only called if DELAYBIND is true. It is a copy of the code at the end of pdf_main.ps
+  % and must be maintained in parallel with it.
   [
   /.pdfawidthshow /.pdfwidthshow /.currentblackptcomp /.setblackptcomp
   /.setfillcolor /.setfillcolorspace /.setstrokecolor /.setstrokecolorspace /.currentrenderingintent /.setrenderingintent
@@ -2356,13 +2399,13 @@ $error /.nosetlocal //false put
 
 (END GLOBAL) VMDEBUG
 
-%% .savelocalstate is part of Display PostScript (if included). Part of the function of
-%% the .savelocalstate routine is to store the 'initial saved gstate' (savedinitialgstate)
-%% in systemdict. The code in dps1.c, gstate_check_space, disallows writing or creating
-%% gstates in global VM in certain conditions. If we execute setpagedevice before we
-%% reach this point, we must ensure that we do so using /..StartupGlobal so that
-%% the dictionary is defined in global VM, because the gstate contains a pointer to the
-%% device dictionary, and if that is allocated in local VM we will fail the gstate check.
+% .savelocalstate is part of Display PostScript (if included). Part of the function of
+% the .savelocalstate routine is to store the 'initial saved gstate' (savedinitialgstate)
+% in systemdict. The code in dps1.c, gstate_check_space, disallows writing or creating
+% gstates in global VM in certain conditions. If we execute setpagedevice before we
+% reach this point, we must ensure that we do so using /..StartupGlobal so that
+% the dictionary is defined in global VM, because the gstate contains a pointer to the
+% device dictionary, and if that is allocated in local VM we will fail the gstate check.
 /.savelocalstate where {
         % If we might create new contexts, save away copies of all dictionaries
         % referenced from systemdict that are stored in local VM,
@@ -2397,8 +2440,8 @@ currentdict /.shadingtypes .undef
 currentdict /.wheredict .undef
 currentdict /.renderingintentdict .undef
 
-%% If we are using DELAYBIND we have to defer the undefinition
-%% until .bindnow.
+% If we are using DELAYBIND we have to defer the undefinition
+% until .bindnow.
 DELAYBIND not {
   SAFER {
     //systemdict /SAFERUndefinePostScriptOperators get exec
@@ -2426,7 +2469,7 @@ systemdict /superexec .knownget {
   systemdict /superexec .undef
 } if
 
-%% Can't remove this one until the last minute :-)
+% Can't remove this one until the last minute :-)
 DELAYBIND not {
 systemdict /.undef .undef
 } if
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_lev2.ps b/Master/tlpkg/tlgs/Resource/Init/gs_lev2.ps
index eee0b9f6175..44fe6195665 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_lev2.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_lev2.ps
@@ -163,10 +163,11 @@ end
         % Set them again to the new values.  From here on, we are safe,
         % since a context switch will consult userparams.
   .setuserparams
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 /setuserparams {		% <dict> setuserparams -
-    .setuserparams2
+    {.setuserparams2} stopped
+    {/setuserparams load $error /errorname get signalerror} if
 } .bind odef
 % Initialize user parameters managed here.
 /JobName () .definepsuserparam
@@ -415,7 +416,9 @@ psuserparams /ProcessDSCComment {.checkprocesscomment} put
 
 % VMReclaim and VMThreshold are user parameters.
 /setvmthreshold {		% <int> setvmthreshold -
-  mark /VMThreshold 2 .argindex .dicttomark .setuserparams2 pop
+  mark /VMThreshold 2 .argindex .dicttomark {.setuserparams2} stopped
+  {pop /setvmthreshold load $error /errorname get signalerror}
+  {pop} ifelse
 } odef
 /vmreclaim {			% <int> vmreclaim -
   dup 0 gt {
@@ -427,7 +430,9 @@ psuserparams /ProcessDSCComment {.checkprocesscomment} put
     ifelse
   } {
     % VMReclaim userparam controls enable/disable GC
-    mark /VMReclaim 2 index .dicttomark .setuserparams2 pop
+    mark /VMReclaim 2 index .dicttomark {.setuserparams2} stopped
+    {pop /vmreclaim load $error /errorname get signalerror}
+    {pop} ifelse
   } ifelse
 } odef
 -1 setvmthreshold
@@ -610,7 +615,14 @@ currentuserparams /WaitTimeout known
    .dicttomark setpagedevice
    /WaitTimeout exch mark /JobTimeout 5 2 roll .dicttomark setsystemparams
  } bind def
-/.setpagesize { 2 array astore /PageSize .dict1 setpagedevice } bind def
+/.setpagesize
+ { 2 copy 2 array astore /PageSize .dict1 { setpagedevice } stopped {
+     pop	% the setpagedevice dict
+     /setpagesize $error /errorname get signalerror
+   } {
+     pop pop	% success -- pop the arguments
+   } ifelse
+ } bind def
 /setduplexmode { /Duplex .dict1 setpagedevice } bind def
 /setmargins
  { exch 2 array astore /Margins .dict1 setpagedevice
@@ -624,7 +636,14 @@ currentuserparams /WaitTimeout known
    .dicttomark setpagedevice
  } bind def
 /setresolution
- { dup 2 array astore /HWResolution .dict1 setpagedevice
+ { count 1 lt { /setresolution /stackunderflow signalerror } if
+   dup type dup /integertype eq exch /realtype eq or not
+   {
+      /setresolution /typecheck signalerror
+   } if
+   dup 2 array astore /HWResolution .dict1 { setpagedevice } stopped {
+     pop /setresolution $error /errorname get signalerror
+   } if
  } bind def
 %END PAGEDEVICE
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_ll3.ps b/Master/tlpkg/tlgs/Resource/Init/gs_ll3.ps
index 1d37e536165..c86721f39fc 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_ll3.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_ll3.ps
@@ -146,6 +146,10 @@ currentdict /.bind_ undef
 } bind def
 
 /.bigstring {	% <size> .bigstring <string|bytestring>
+  count 1 lt { /.bigstring /stackunderflow signalerror } if
+  dup type /integertype ne {
+    /.bigstring /typecheck signalerror
+  } if
   dup 65400 gt { .bytestring } { string } ifelse
 } bind def
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_pdfwr.ps b/Master/tlpkg/tlgs/Resource/Init/gs_pdfwr.ps
index fb1c4191c4d..58e75d3a483 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_pdfwr.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_pdfwr.ps
@@ -660,7 +660,7 @@ currentdict /.pdfmarkparams .undef
   {
     pop
   } ifelse
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef % must be bound and hidden for .forceput
 
 % Use the DSC processing hook to pass DSC comments to the driver.
 % We use a pseudo-parameter named DSC whose value is an array:
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_res.ps b/Master/tlpkg/tlgs/Resource/Init/gs_res.ps
index d1e10c939d8..8eb8bb0e582 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_res.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_res.ps
@@ -155,10 +155,10 @@ setglobal
         } {
           /defineresource cvx /typecheck signaloperror
         } ifelse
-} bind def
+} bind executeonly odef
 /FindResource		% (redefined below)
         { .Instances exch get 0 get
-        } bind def
+        } bind executeonly def
 
                 % Additional entries
 
@@ -210,7 +210,7 @@ def
       /findresource .systemvar /typecheck signalerror
     } if
     /findresource cvx //.findresource .errorexec
-} odef
+} bind executeonly odef
 
 /defineresource {	% <key> <instance> <category> defineresource <instance>
     2 .argindex 2 index 2 index	% catch stackunderflow
@@ -226,7 +226,7 @@ def
         /DefineResource .resourceexec
         4 1 roll pop pop pop
     } .errorexec
-} bind odef
+} bind executeonly odef
 % We must prevent resourceforall from automatically restoring the stacks,
 % because we don't want the stacks restored if proc causes an error or
 % executes a 'stop'. On the other hand, resourceforall is defined in the
@@ -240,10 +240,10 @@ def
         % Stack: <template> <proc> <scratch> <category> proc
         exch pop		% pop the category
         exec end
-} bind def
+} bind executeonly def
 /resourceforall {	% <template> <proc> <scratch> <category> resourceforall1 -
         //resourceforall1 exec		% see above
-} bind odef
+} bind executeonly odef
 /resourcestatus {	% <key> <category> resourcestatus <status> <size> true
                         % <key> <category> resourcestatus false
   {
@@ -259,7 +259,7 @@ def
     % for error reporting. CET 23-26
     /resourcestatus cvx $error /errorname get signalerror
   } if
-} bind odef
+} bind executeonly odef
 /undefineresource {	% <key> <category> undefineresource -
   0 .argindex type /nametype ne {
     /undefinedresource cvx /typecheck signaloperror
@@ -272,7 +272,7 @@ def
     % here but uses operator for the errors above. CET 23-33
     /undefineresource cvx $error /errorname get signalerror
   } if
-} bind odef
+} bind executeonly odef
 
 % Define the system parameters used for the Generic implementation of
 % ResourceFileName.
@@ -412,7 +412,7 @@ status {
   } ifelse
 } bind def
 
-/DefineResource {
+/DefineResource dup {
         .CheckResource
            { dup [ exch 0 -1 ]
                         % Stack: key value instance
@@ -441,7 +441,7 @@ status {
            { /defineresource cvx /typecheck signaloperror
            }
         ifelse
-} .bind executeonly		% executeonly to prevent access to .forcedef
+} .bind executeonly .makeoperator		% executeonly to prevent access to .forcedef
 /UndefineResource
         {  { dup 2 index .knownget
               { dup 1 get 1 ge
@@ -457,7 +457,7 @@ status {
            { 2 copy .Instances exch exec
            }
           if .LocalInstances exch exec
-        } bind
+        } bind executeonly
 % Because of some badly designed code in Adobe's CID font downloader that
 % makes findresource and resourcestatus deliberately inconsistent with each
 % other, the default FindResource must not call ResourceStatus if there is
@@ -483,7 +483,7 @@ status {
            /findresource cvx .undefinedresource
           } ifelse
         } ifelse
-} bind
+} bind executeonly
 % Because of some badly designed code in Adobe's CID font downloader, the
 % definition of ResourceStatus for Generic and Font must be the same (!).
 % We patch around this by using an intermediate .ResourceFileStatus procedure.
@@ -493,10 +493,10 @@ status {
         } {
           .ResourceFileStatus
         } ifelse
-} bind
+} bind executeonly
 /.ResourceFileStatus {
         .ResourceFile { closefile 2 -1 //true } { pop //false } ifelse
-} bind
+} bind executeonly
 /ResourceForAll {
                 % Construct a new procedure to hold the arguments.
                 % All objects constructed here must be in local VM to avoid
@@ -554,7 +554,7 @@ status {
         3 2 roll pop % args
         { forall } 0 get
         currentdict end 2 .execn begin
-} bind
+} bind executeonly
 
 /ResourceFileName  {                          % /in (scr) --> (p/c/n)
   exch //.rfnstring cvs                       % (scr) (n)
@@ -586,7 +586,7 @@ status {
     ifelse
   } ifelse
   exch copy                                   % (p/c/n)
-} bind
+} bind executeonly
 
                 % Additional entries
 
@@ -752,17 +752,17 @@ counttomark 2 idiv
              ifelse
            }
           ifelse
-        } bind
+        } bind executeonly
    /UndefineResource
-        { /undefineresource cvx /invalidaccess signaloperror } bind
+        { /undefineresource cvx /invalidaccess signaloperror } bind executeonly
    /FindResource
         { .Instances 1 index .knownget
            { exch pop }
            { /findresource cvx .undefinedresource }
           ifelse
-        } bind
+        } bind executeonly
    /ResourceStatus
-        { .Instances exch known { 0 0 //true } { //false } ifelse } bind
+        { .Instances exch known { 0 0 //true } { //false } ifelse } bind executeonly
    /ResourceForAll
         /Generic .findcategory /ResourceForAll load end
 
@@ -865,7 +865,7 @@ userdict /.localcsdefaults //false put
     1 index .definedefaultcs
     currentglobal not { .userdict /.localcsdefaults //true put } if
   } if
-} bind
+} bind executeonly
 
 /UndefineResource {
   dup /Generic /Category findresource /UndefineResource get exec
@@ -888,7 +888,7 @@ userdict /.localcsdefaults //false put
   } {
     pop
   } ifelse
-} bind
+} bind executeonly
 
 .definecategory			% ColorSpace
 
@@ -918,7 +918,7 @@ userdict /.localcsdefaults //false put
     { exch copy exch pop }
     { /Generic /Category findresource /ResourceFileName get exec }
    ifelse
- } bind
+ } bind executeonly
 
 .definecategory			% Encoding
 
@@ -991,11 +991,11 @@ currentdict /.fontstatusaux .undef
 /DefineResource
         { 2 copy //definefont exch pop
           /Generic /Category findresource /DefineResource get exec
-        } bind
+        } bind executeonly
 /UndefineResource
         { dup //undefinefont
           /Generic /Category findresource /UndefineResource get exec
-        } bind
+        } bind executeonly
 /FindResource {
         dup .getvminstance {
           exch pop 0 get
@@ -1006,14 +1006,14 @@ currentdict /.fontstatusaux .undef
             .loadfontresource
           } ifelse
         } ifelse
-} bind
+} bind executeonly
 /ResourceForAll {
         { .scannextfontdir not { exit } if } loop
         /Generic /Category findresource /ResourceForAll get exec
-} bind
+} bind executeonly
 /.ResourceFileStatus {
         .fontstatus { pop 2 -1 //true } { pop //false } ifelse
-} bind
+} bind executeonly
 
 /.loadfontresource {
         dup .vmused exch
@@ -1063,20 +1063,20 @@ end
   { /Font defineresource } stopped {
       /definefont cvx $error /errorname get signalerror
   } if
-} bind odef
+} bind executeonly odef
 /undefinefont {
   /Font undefineresource
-} bind odef
+} bind executeonly odef
 % The Red Book requires that findfont be a procedure, not an operator,
 % but it still needs to restore the stacks reliably if it fails.
 /.findfontop {
   { /Font findresource } stopped {
     pop /findfont $error /errorname get signalerror
   } if
-} bind odef
+} bind executeonly odef
 /findfont {
   .findfontop
-} bind def	% Must be a procedure, not an operator
+} bind executeonly def	% Must be a procedure, not an operator
 
 % Remove initialization utilities.
 currentdict /.definecategory .undef
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_resmp.ps b/Master/tlpkg/tlgs/Resource/Init/gs_resmp.ps
index 7cacaf8a4cd..9bb42638ad2 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_resmp.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_resmp.ps
@@ -183,7 +183,7 @@ setpacking
   % We don't check them.
 
   currentglobal //false setglobal                  % <object> bGlobal
-  countexecstack array execstack                   % <object> bGlobal [execstack]
+  //false .countexecstack array //false .execstack % <object> bGlobal [execstack]
   dup //null exch                                  % <object> bGlobal [execstack] null [execstack]
   length 3 sub -1 0 {                              % <object> bGlobal [execstack] null i
     2 index exch get                               % <object> bGlobal [execstack] null proc
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_setpd.ps b/Master/tlpkg/tlgs/Resource/Init/gs_setpd.ps
index 8fa7c51df15..e22597ebb5f 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_setpd.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_setpd.ps
@@ -608,59 +608,72 @@ NOMEDIAATTRS {
 % in the <failed> dictionary with the policy value,
 % and we replace the key in the <merged> dictionary with its prior value
 % (or remove it if it had no prior value).
-/.policyprocs mark
+
 % These procedures are called with the following on the stack:
 %   <orig> <merged> <failed> <Policies> <key> <policy>
 % They are expected to consume the top 2 operands.
 % NOTE: we currently treat all values other than 0, 1, or 7 (for PageSize)
 % the same as 0, i.e., we signal an error.
-%
-% M. Sweet, Easy Software Products:
-%
-% Define NOMEDIAATTRS to turn off the default (but unimplementable) media
-% selection policies for setpagedevice.  This is used by CUPS to support
-% the standard Adobe media attributes.
-  0 {		% Set errorinfo and signal a configurationerror.
-      NOMEDIAATTRS {
-        % NOMEDIAATTRS means that the default policy is 7...
-        pop 2 index exch 7 put
-      } {
-        pop dup 4 index exch get 2 array astore
-        $error /errorinfo 3 -1 roll put
-        cleartomark
-        /setpagedevice .systemvar /configurationerror signalerror
-      } ifelse
-  } bind
-  1 {		% Roll back the failed request to its previous status.
-SETPDDEBUG { (Rolling back.) = pstack flush } if
-        3 index 2 index 3 -1 roll .forceput
-        4 index 1 index .knownget
-         { 4 index 3 1 roll .forceput }
-         { 3 index exch .undef }
-        ifelse
-  } .bind executeonly % must be bound and hidden for .forceput
-  7 {		% For PageSize only, just impose the request.
-        1 index /PageSize eq
-         { pop pop 1 index /PageSize 7 put }
-         { .policyprocs 0 get exec }
-        ifelse
-  } bind
-.dicttomark readonly def
+/0Policy {		% Set errorinfo and signal a configurationerror.
+  NOMEDIAATTRS {
+    % NOMEDIAATTRS means that the default policy is 7...
+    pop 2 index exch 7 put
+  } {
+    pop dup 4 index exch get 2 array astore
+    $error /errorinfo 3 -1 roll put
+    cleartomark
+    /setpagedevice .systemvar /configurationerror signalerror
+  } ifelse
+} bind executeonly odef
+
+% Making this an operator means we can properly hide
+% the contents - specifically .forceput
+/1Policy
+{
+  % Roll back the failed request to its previous status.
+  SETPDDEBUG { (Rolling back.) = pstack flush } if
+  3 index 2 index 3 -1 roll .forceput
+  4 index 1 index .knownget
+  { 4 index 3 1 roll .forceput }
+  { 3 index exch .undef }
+  ifelse
+} bind executeonly odef
+
+/7Policy {		% For PageSize only, just impose the request.
+  1 index /PageSize eq
+  { pop pop 1 index /PageSize 7 put }
+  { .policyprocs 0 get exec }
+  ifelse
+} bind executeonly odef
+
 /.applypolicies		% <orig> <merged> <failed> .applypolicies
                         %   <orig> <merged'> <failed'>
- { 1 index /Policies get 1 index
-    { type /integertype eq
-       { pop		% already processed
-       }
-       { 2 copy .knownget not { 1 index /PolicyNotFound get } if
-                        % Stack: <orig> <merged> <failed> <Policies> <key>
-                        %   <policy>
-         .policyprocs 1 index .knownget not { .policyprocs 0 get } if exec
-       }
-      ifelse
-    }
-   forall pop
- } bind def
+{
+  1 index /Policies get 1 index
+  { type /integertype eq
+     {
+       pop		% already processed
+     }{
+       2 copy .knownget not { 1 index /PolicyNotFound get } if
+                      % Stack: <orig> <merged> <failed> <Policies> <key>
+                      %   <policy>
+        dup 1 eq {
+          1Policy
+        }{
+          dup 7 eq {
+            7Policy
+          }{
+            0Policy
+          } ifelse
+        } ifelse
+     } ifelse
+  }
+  forall pop
+} bind executeonly odef
+
+currentdict /0Policy undef
+currentdict /1Policy undef
+currentdict /7Policy undef
 
 % Prepare to present parameters to the device, by spreading them onto the
 % operand stack and removing any that shouldn't be presented.
@@ -877,7 +890,13 @@ SETPDDEBUG { (Selecting.) = pstack flush } if
                 % Stack: mark <orig> <request> <merged> <failed>
 SETPDDEBUG { (Constructing.) = pstack flush } if
 
-   currentdevice .devicename 2 index /OutputDevice get eq
+   % Non-obvious: we need to check the name of the output device, to tell
+   % whether we're going to have to replace the entire device chain (which
+   % may be only one device, or may be multiple devices.
+   % If we're not replacing the entire change, we have to use the device in
+   % the graphics state, so the configuration of the entire device chain is
+   % correctly set.
+   .currentoutputdevice .devicename 2 index /OutputDevice get eq
     { currentdevice }
     { 1 index /OutputDevice get finddevice }
    ifelse
@@ -913,10 +932,15 @@ SETPDDEBUG { (Recovering.) = pstack flush } if
                 % Stack: mark ... <merged> <failed> <device> <eraseflag>
 SETPDDEBUG { (Installing.) = pstack flush } if
 
-    pop
+   pop
                 % .setdevice clears the current page device!
    .currentpagedevice pop exch
-   .setdevice pop
+   { .setdevice } stopped {
+     cleartomark exch pop
+     /setpagedevice $error /errorname get
+     signalerror
+   } if
+   pop
    .setpagedevice
 
                 % Implement UseCIEColor directly if this is a LL3 system.
@@ -997,7 +1021,7 @@ SETPDDEBUG { (Installing.) = pstack flush } if
     .postinstall
   } ifelse
   setglobal           % return to original VM allocation mode
-} odef
+} bind executeonly odef
 
 % We break out the code after calling the Install procedure into a
 % separate procedure, since it is executed even if Install causes an error.
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_statd.ps b/Master/tlpkg/tlgs/Resource/Init/gs_statd.ps
index 64c6463d103..20d4c96c4f8 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_statd.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_statd.ps
@@ -39,20 +39,26 @@ statusdict begin
 % These procedures are also accessed as data structures during initialization,
 % so the page dimensions must be the first two elements of the procedure.
 
-/.setpagesize { /statusdict .systemvar begin .setpagesize end } bind def
+/.setpagesize {
+   /statusdict .systemvar begin
+   { .setpagesize } stopped {
+     /setpagesize $error /errorname get signalerror
+   } if
+   end
+} bind def
 
                 % Page sizes defined by Adobe documentation
                 % Note: these executable arrays should all begin with two
                 % integers which are the width and height (see gs_setpd.ps).
- /11x17 {792 1224 //.setpagesize exec} bind def  % 11x17 portrait
- /a3 {842 1191 //.setpagesize exec} bind def
- /a4 {595 842 //.setpagesize exec} bind def
+ /11x17 {792 1224 //.setpagesize stopped { pop pop /11x17 $error /errorname get signalerror } if } bind def  % 11x17 portrait
+ /a3 {842 1191 //.setpagesize stopped { pop pop /a3 $error /errorname get signalerror } if } bind def
+ /a4 {595 842 //.setpagesize stopped { pop pop /a4 $error /errorname get signalerror } if } bind def
 % a4small should be a4 with an ImagingBBox of [25 25 570 817].
  /a4small /a4 load def
 % b5 see below.
- /ledger {1224 792 //.setpagesize exec} bind def  % 11x17 landscape
- /legal {612 1008 //.setpagesize exec} bind def
- /letter {612 792 //.setpagesize exec} bind def
+ /ledger {1224 792 //.setpagesize stopped { pop pop /ledger $error /errorname get signalerror } if } bind def  % 11x17 landscape
+ /legal {612 1008 //.setpagesize stopped { pop pop /legal $error /errorname get signalerror } if } bind def
+ /letter {612 792 //.setpagesize stopped { pop pop /letter $error /errorname get signalerror } if } bind def
 % lettersmall should be letter with an ImagingBBox of [25 25 587 767].
  /lettersmall /letter load def
 % note should be letter (or some other size) with the ImagingBBox
@@ -62,68 +68,68 @@ statusdict begin
 
                 % Other page sizes
         % ISO standard paper sizes
- /a0 {2384 3370 //.setpagesize exec} bind def
- /a1 {1684 2384 //.setpagesize exec} bind def
- /a2 {1191 1684 //.setpagesize exec} bind def
-% /a3 {842 1191 //.setpagesize exec} bind def	% defined by Adobe
-% /a4 {595 842 //.setpagesize exec} bind def	% defined by Adobe
- /a5 {420 595 //.setpagesize exec} bind def
- /a6 {297 420 //.setpagesize exec} bind def
- /a7 {210 297 //.setpagesize exec} bind def
- /a8 {148 210 //.setpagesize exec} bind def
- /a9 {105 148 //.setpagesize exec} bind def
- /a10 {73 105 //.setpagesize exec} bind def
+ /a0 {2384 3370 //.setpagesize stopped { pop pop /a0 $error /errorname get signalerror } if } bind def
+ /a1 {1684 2384 //.setpagesize stopped { pop pop /a1 $error /errorname get signalerror } if } bind def
+ /a2 {1191 1684 //.setpagesize stopped { pop pop /a2 $error /errorname get signalerror } if } bind def
+% /a3 {842 1191 //.setpagesize stopped { pop pop /a3 $error /errorname get signalerror } if } bind def	% defined by Adobe
+% /a4 {595 842 //.setpagesize stopped { pop pop /a4 $error /errorname get signalerror } if } bind def	% defined by Adobe
+ /a5 {420 595 //.setpagesize stopped { pop pop /a5 $error /errorname get signalerror } if } bind def
+ /a6 {297 420 //.setpagesize stopped { pop pop /a6 $error /errorname get signalerror } if } bind def
+ /a7 {210 297 //.setpagesize stopped { pop pop /a7 $error /errorname get signalerror } if } bind def
+ /a8 {148 210 //.setpagesize stopped { pop pop /a8 $error /errorname get signalerror } if } bind def
+ /a9 {105 148 //.setpagesize stopped { pop pop /a9 $error /errorname get signalerror } if } bind def
+ /a10 {73 105 //.setpagesize stopped { pop pop /a10 $error /errorname get signalerror } if } bind def
 % ISO and JIS B sizes are different....
- /isob0 {2835 4008 //.setpagesize exec} bind def
+ /isob0 {2835 4008 //.setpagesize stopped { pop pop /isob0 $error /errorname get signalerror } if } bind def
  /b0 /isob0 load def
- /isob1 {2004 2835 //.setpagesize exec} bind def
+ /isob1 {2004 2835 //.setpagesize stopped { pop pop /isob1 $error /errorname get signalerror } if } bind def
  /b1 /isob1 load def
- /isob2 {1417 2004 //.setpagesize exec} bind def
+ /isob2 {1417 2004 //.setpagesize stopped { pop pop /isob2 $error /errorname get signalerror } if } bind def
  /b2 /isob2 load def
- /isob3 {1001 1417 //.setpagesize exec} bind def
+ /isob3 {1001 1417 //.setpagesize stopped { pop pop /isob3 $error /errorname get signalerror } if } bind def
  /b3 /isob3 load def
- /isob4 {709 1001 //.setpagesize exec} bind def
+ /isob4 {709 1001 //.setpagesize stopped { pop pop /isob4 $error /errorname get signalerror } if } bind def
  /b4 /isob4 load def
- /isob5 {499 709 //.setpagesize exec} bind def
+ /isob5 {499 709 //.setpagesize stopped { pop pop /isob5 $error /errorname get signalerror } if } bind def
  /b5 /isob5 load def
- /isob6 {354 499 //.setpagesize exec} bind def
+ /isob6 {354 499 //.setpagesize stopped { pop pop /isob6 $error /errorname get signalerror } if } bind def
  /b6 /isob6 load def
- /jisb0 {2920 4127 //.setpagesize exec} bind def
- /jisb1 {2064 2920 //.setpagesize exec} bind def
- /jisb2 {1460 2064 //.setpagesize exec} bind def
- /jisb3 {1032 1460 //.setpagesize exec} bind def
- /jisb4 {729 1032 //.setpagesize exec} bind def
- /jisb5 {516 729 //.setpagesize exec} bind def
- /jisb6 {363 516 //.setpagesize exec} bind def
- /c0 {2599 3677 //.setpagesize exec} bind def
- /c1 {1837 2599 //.setpagesize exec} bind def
- /c2 {1298 1837 //.setpagesize exec} bind def
- /c3 {918 1298 //.setpagesize exec} bind def
- /c4 {649 918 //.setpagesize exec} bind def
- /c5 {459 649 //.setpagesize exec} bind def
- /c6 {323 459 //.setpagesize exec} bind def
+ /jisb0 {2920 4127 //.setpagesize stopped { pop pop /jisb0 $error /errorname get signalerror } if } bind def
+ /jisb1 {2064 2920 //.setpagesize stopped { pop pop /jisb1 $error /errorname get signalerror } if } bind def
+ /jisb2 {1460 2064 //.setpagesize stopped { pop pop /jisb2 $error /errorname get signalerror } if } bind def
+ /jisb3 {1032 1460 //.setpagesize stopped { pop pop /jisb3 $error /errorname get signalerror } if } bind def
+ /jisb4 {729 1032 //.setpagesize stopped { pop pop /jisb4 $error /errorname get signalerror } if } bind def
+ /jisb5 {516 729 //.setpagesize stopped { pop pop /jisb5 $error /errorname get signalerror } if } bind def
+ /jisb6 {363 516 //.setpagesize stopped { pop pop /jisb6 $error /errorname get signalerror } if } bind def
+ /c0 {2599 3677 //.setpagesize stopped { pop pop /c0 $error /errorname get signalerror } if } bind def
+ /c1 {1837 2599 //.setpagesize stopped { pop pop /c1 $error /errorname get signalerror } if } bind def
+ /c2 {1298 1837 //.setpagesize stopped { pop pop /c2 $error /errorname get signalerror } if } bind def
+ /c3 {918 1298 //.setpagesize stopped { pop pop /c3 $error /errorname get signalerror } if } bind def
+ /c4 {649 918 //.setpagesize stopped { pop pop /c4 $error /errorname get signalerror } if } bind def
+ /c5 {459 649 //.setpagesize stopped { pop pop /c5 $error /errorname get signalerror } if } bind def
+ /c6 {323 459 //.setpagesize stopped { pop pop /c6 $error /errorname get signalerror } if } bind def
         % U.S. CAD standard paper sizes
- /archE {2592 3456 //.setpagesize exec} bind def
- /archD {1728 2592 //.setpagesize exec} bind def
- /archC {1296 1728 //.setpagesize exec} bind def
- /archB {864 1296 //.setpagesize exec} bind def
- /archA {648 864 //.setpagesize exec} bind def
+ /archE {2592 3456 //.setpagesize stopped { pop pop /archE $error /errorname get signalerror } if } bind def
+ /archD {1728 2592 //.setpagesize stopped { pop pop /archD $error /errorname get signalerror } if } bind def
+ /archC {1296 1728 //.setpagesize stopped { pop pop /archC $error /errorname get signalerror } if } bind def
+ /archB {864 1296 //.setpagesize stopped { pop pop /archB $error /errorname get signalerror } if } bind def
+ /archA {648 864 //.setpagesize stopped { pop pop /archA $error /errorname get signalerror } if } bind def
         % Other paper sizes
- /flsa {612 936 //.setpagesize exec} bind def  % U.S. foolscap
- /flse {612 936 //.setpagesize exec} bind def  % European foolscap
- /halfletter {396 612 //.setpagesize exec} bind def
+ /flsa {612 936 //.setpagesize stopped { pop pop /flsa $error /errorname get signalerror } if } bind def  % U.S. foolscap
+ /flse {612 936 //.setpagesize stopped { pop pop /flse $error /errorname get signalerror } if } bind def  % European foolscap
+ /halfletter {396 612 //.setpagesize stopped { pop pop /halfletter $error /errorname get signalerror } if } bind def
         % minimum of a4 and letter (a4 width, letter length)
- /pa4 {595 792 //.setpagesize exec} bind def
+ /pa4 {595 792 //.setpagesize stopped { pop pop /pa4 $error /errorname get signalerror } if } bind def
         % Japanese postcard size, 100mm x 148mm
- /hagaki {283 420 //.setpagesize exec} bind def
+ /hagaki {283 420 //.setpagesize stopped { pop pop /hagaki $error /errorname get signalerror } if } bind def
         % U.S. ANSI/ASME Y14.1 paper sizes
  /ANSI_A  //letter def
  /ANSI_B  //11x17  def
  /tabloid //11x17  def
- /ANSI_C {1224 1585 //.setpagesize exec} bind def
- /ANSI_D {1585 2448 //.setpagesize exec} bind def
- /ANSI_E {2448 3168 //.setpagesize exec} bind def
- /ANSI_F {2016 2880 //.setpagesize exec} bind def
+ /ANSI_C {1224 1585 //.setpagesize stopped { pop pop /ANSI_C $error /errorname get signalerror } if } bind def
+ /ANSI_D {1585 2448 //.setpagesize stopped { pop pop /ANSI_D $error /errorname get signalerror } if } bind def
+ /ANSI_E {2448 3168 //.setpagesize stopped { pop pop /ANSI_E $error /errorname get signalerror } if } bind def
+ /ANSI_F {2016 2880 //.setpagesize stopped { pop pop /ANSI_F $error /errorname get signalerror } if } bind def
 %END SIZES
 currentdict end
 dup /.setpagesize .undef
@@ -158,19 +164,19 @@ readonly def
 
 % Tray and format selection
 
- /11x17tray {/11x17 .uservar exec} bind def
- /a3tray {/a3 .uservar exec} bind def
- /a4tray {/a4 .uservar exec} bind def
- /a5tray {/a5 .uservar exec} bind def
- /a6tray {/a6 .uservar exec} bind def
- /b4tray {/b4 .uservar exec} bind def
- /b5tray {/b5 .uservar exec} bind def
- /flsatray {/flsa .uservar exec} bind def
- /flsetray {/flse .uservar exec} bind def
- /halflettertray {/halfletter .uservar exec} bind def
- /ledgertray {/ledger .uservar exec} bind def
- /legaltray {/legal .uservar exec} bind def
- /lettertray {/letter .uservar exec} bind def
+ /11x17tray {/11x17 .uservar stopped { pop pop /11x17tray $error /errorname get signalerror } if } bind def
+ /a3tray {/a3 .uservar stopped { pop pop /a3tray $error /errorname get signalerror } if } bind def
+ /a4tray {/a4 .uservar stopped { pop pop /a4tray $error /errorname get signalerror } if } bind def
+ /a5tray {/a5 .uservar stopped { pop pop /a5tray $error /errorname get signalerror } if } bind def
+ /a6tray {/a6 .uservar stopped { pop pop /a6tray $error /errorname get signalerror } if } bind def
+ /b4tray {/b4 .uservar stopped { pop pop /b4tray $error /errorname get signalerror } if } bind def
+ /b5tray {/b5 .uservar stopped { pop pop /b5tray $error /errorname get signalerror } if } bind def
+ /flsatray {/flsa .uservar stopped { pop pop /flsatray $error /errorname get signalerror } if } bind def
+ /flsetray {/flse .uservar stopped { pop pop /flsetray $error /errorname get signalerror } if } bind def
+ /halflettertray {/halfletter .uservar stopped { pop pop /halflettertray $error /errorname get signalerror } if } bind def
+ /ledgertray {/ledger .uservar stopped { pop pop /ledgertray $error /errorname get signalerror } if } bind def
+ /legaltray {/legal .uservar stopped { pop pop /legaltray $error /errorname get signalerror } if } bind def
+ /lettertray {/letter .uservar stopped { pop pop /lettertray $error /errorname get signalerror } if } bind def
 
 % Per-job parameters
 
@@ -261,9 +267,17 @@ readonly def
                 % The Adobe documentation only defines setpagetype
                 % (a Level 1 operator) as accepting the values 0 and 1,
                 % so we do too.
-      {/letter /note} 1 index get
-      //systemdict /userdict get exch get cvx exec
-      /pagetype exch def
+      dup type /integertype ne {
+        /setpage /typecheck signalerror
+      } {
+        dup 0 ne 1 index 1 ne or {
+          /setpage /rangecheck signalerror
+        } {
+          {/letter /note} 1 index get
+          //systemdict /userdict get exch get cvx exec
+        } ifelse
+        /pagetype exch def
+    } ifelse
     end
   } bind def
 
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_typ32.ps b/Master/tlpkg/tlgs/Resource/Init/gs_typ32.ps
index b6600b0ce81..9150f71873a 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_typ32.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_typ32.ps
@@ -79,15 +79,19 @@ systemdict /.removeglyphs .undef
 .dicttomark /ProcSet defineresource pop
 
 /.cidfonttypes where { pop } { /.cidfonttypes 6 dict def } ifelse
-.cidfonttypes begin
-
-4	% CIDFontType 4 = FontType 32
-{ dup /FontType 32 .forceput
+/CIDFontType4
+{
+  dup /FontType 32 .forceput
   dup /CharStrings 20 dict .forceput
   1 index exch .buildfont32 exch pop
-} .bind executeonly def % must be bound and hidden for .forceput
+} .bind executeonly odef
+.cidfonttypes begin
+
+
+4 /CIDFontType4 load def % CIDFontType 4 = FontType 32
 
 end		% .cidfonttypes
+currentdict /CIDFontType4 .forceundef
 
 % Define the BuildGlyph procedure.
 % Since Type 32 fonts are indexed by CID, there is no BuildChar procedure.
diff --git a/Master/tlpkg/tlgs/Resource/Init/gs_type1.ps b/Master/tlpkg/tlgs/Resource/Init/gs_type1.ps
index efdae48b284..96e1ced240c 100644
--- a/Master/tlpkg/tlgs/Resource/Init/gs_type1.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/gs_type1.ps
@@ -166,7 +166,7 @@ ifelse
         % However, we can't use any of the other well-known dictionaries
         % (such as userdict), since the whole point of pushing systemdict
         % is to make sure that nothing important has been redefined.
-   /userdict .systemvar begin
+   32 dict begin
         % We can't just use `run', because we want to check for .PFB files.
    currentpacking
     { //false setpacking .loadfont1 //true setpacking }
@@ -283,7 +283,7 @@ currentdict /closesourcedict .undef
   } if
   2 copy /WeightVector exch .forceput
   .setweightvector
-} .bind executeonly def
+} .bind executeonly odef
 end
 
 % Register the font types for definefont.
diff --git a/Master/tlpkg/tlgs/Resource/Init/pdf_base.ps b/Master/tlpkg/tlgs/Resource/Init/pdf_base.ps
index a82a2a3adfc..b45e9803165 100644
--- a/Master/tlpkg/tlgs/Resource/Init/pdf_base.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/pdf_base.ps
@@ -218,7 +218,7 @@ currentdict /num-chars-dict .undef
       } ifelse
     } ifelse
   } ifelse
-} bind executeonly def
+} bind executeonly odef
 /PDFScanRules_true << /PDFScanRules //true >> def
 /PDFScanRules_null << /PDFScanRules //null >> def
 /.pdfrun {			% <file> <opdict> .pdfrun -
@@ -395,7 +395,14 @@ currentdict /token_nofail_dict .undef
     dup Objects exch array dup 3 1 roll copy pop /Objects exch def
   } if
   dup Generations length gt {
-    dup Generations exch string dup 3 1 roll copy pop /Generations exch def
+    %% Initiallly Generations is a string, but the xref rebuilding code
+    %% can convert it to an array (/setxrefentry in pdf_rbld.ps). So we
+    %% need to be able to deal with either case.
+    Generations type /stringtype eq {
+      dup Generations exch string dup 3 1 roll copy pop /Generations exch def
+    } {
+      dup Generations exch array dup 3 1 roll copy pop /Generations exch def
+    } ifelse
   } if
   dup IsGlobal length gt {
     dup IsGlobal exch string dup 3 1 roll copy pop /IsGlobal exch def
diff --git a/Master/tlpkg/tlgs/Resource/Init/pdf_draw.ps b/Master/tlpkg/tlgs/Resource/Init/pdf_draw.ps
index d1b6ac909d3..6b0ba93e1e7 100644
--- a/Master/tlpkg/tlgs/Resource/Init/pdf_draw.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/pdf_draw.ps
@@ -1158,7 +1158,7 @@ currentdict end readonly def
   Q
   PDFDEBUG { pdfdict /PDFSTEPcount .knownget { 1 le } { //true } ifelse { (%End PaintProc) print dup === flush } if } if
   PDFfile exch setfileposition
-} bind executeonly def
+} bind executeonly odef
 
 /.pdfpaintproc {
     %% Get the /m from pdfopdict (must be present)
@@ -1189,7 +1189,7 @@ currentdict end readonly def
     {
       switch_to_text_marking_ops
     } if
-}bind executeonly def
+}bind executeonly odef
 
 /resolvepattern {	% <patternstreamdict> resolvepattern <patterndict>
                 % Don't do the resolvestream now: just capture the data
@@ -2353,7 +2353,7 @@ currentdict /last-ditch-bpc-csp undef
   }{
     pdfdict /AppearanceNumber 0 .forceput
   } ifelse
-}bind executeonly def
+}bind executeonly odef
 
 /MakeAppearanceName {
   pdfdict /AppearanceNumber get
@@ -2382,7 +2382,7 @@ currentdict /last-ditch-bpc-csp undef
   DoForm
   pdfdict /.PreservePDFForm 3 -1 roll .forceput
   grestore
-} bind executeonly def
+} bind executeonly odef
 
 /DoForm {
   %% save the current value, if its true we will set it to false later, in order
@@ -2541,7 +2541,7 @@ currentdict /last-ditch-bpc-csp undef
     end
   } if
   pdfdict /.PreservePDFForm 3 -1 roll .forceput
-} bind executeonly def
+} bind executeonly odef
 
 /_dops_save 1 array def
 
@@ -3445,6 +3445,19 @@ currentdict /set_bc_color undef
     } if
   }bind executeonly def
 
+  /ValidateAP {
+    dup /AP oknown {
+        dup /AP oget
+        /N oknown not {
+          //false
+        } {
+          //true
+        } ifelse
+    } {
+      //false
+    }ifelse
+  } bind executeonly def
+
   % x0 y0 x1 y1 x2 y2 x3 y3 -> x0 y0 x1-x0 y1-y0 x2-x0 y2-y0
   /quadpoints2basis {
     8 { oforce 8 1 roll } repeat
@@ -3489,9 +3502,10 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /Square {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
-    }{
+    } {
       gsave
       //startannottransparency exec
       dup
@@ -3532,9 +3546,10 @@ currentdict /set_bc_color undef
 }bind executeonly def
 
   /Circle {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
-    }{
+    } {
       gsave
       //startannottransparency exec
       dup annotrect 4 2 roll exch 3 index 2 div add exch 2 index 2 div add
@@ -3549,9 +3564,10 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /Polygon {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
-    }{
+    } {
       gsave
       //startannottransparency exec
       dup /Vertices knownoget {
@@ -3802,7 +3818,8 @@ currentdict /set_bc_color undef
   currentdict end readonly def
 
   /Line  {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       gsave
@@ -3844,9 +3861,10 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /PolyLine {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
-    }{
+    } {
       gsave
       //startannottransparency exec
       dup /Vertices knownoget {
@@ -3916,7 +3934,8 @@ currentdict /set_bc_color undef
 
   /Ink { % <annot> -> <annot> <true>
          % <annot> -> <false>
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       //startannottransparency exec
@@ -3967,7 +3986,8 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /Underline {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       0 setlinecap
@@ -4006,7 +4026,8 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /StrikeOut {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       0 setlinecap
@@ -4067,12 +4088,10 @@ currentdict /set_bc_color undef
   /emptydict 0 dict readonly def
 
   /Highlight {
-% technically we should apply an appearance stream if we have one, but if we do
-% some test files don't match Acrobat. PDF 2.0 says appearance streams are mandatory,
-% and take precedence over generatig new ones, so we may need to revisit this.
-%    dup /AP oknown {
-%      //true
-%    }{
+    //ValidateAP exec
+    {
+      //true
+    } {
     0 setlinecap
     dup annotsetcolor {
       /QuadPoints knownoget {
@@ -4096,13 +4115,14 @@ currentdict /set_bc_color undef
       } if
     } if
     //false
-%    } ifelse
+    } ifelse
   } bind executeonly def
   currentdict /emptydict undef
   currentdict /highlight-arc undef
 
   /Squiggly {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       //startannottransparency exec
@@ -4160,7 +4180,8 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /Text {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       //startannottransparency exec
@@ -4202,16 +4223,10 @@ currentdict /set_bc_color undef
   } bind executeonly def
 
   /FreeText {
-    dup /AP knownoget {
-        %% Check minimal entriy in /AP dictionary
-        /N known not {
-          //true
-        }{
-          //false
-        }ifelse
-      } {
-        //true
-    }ifelse
+    //ValidateAP exec
+    {
+      //true
+    }
     %% We either have no appearance, or its invalid, make one up.
     {
       gsave
@@ -4382,9 +4397,6 @@ currentdict /set_bc_color undef
       //endannottransparency exec
       //false
       grestore
-    }
-    {
-      //true
     } ifelse
   } bind executeonly def
 
@@ -4499,7 +4511,8 @@ currentdict /set_bc_color undef
   {/text/frame/red/green/blue} {currentdict exch undef} forall
 
   /Stamp  {
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       //startannottransparency exec
@@ -4533,9 +4546,10 @@ currentdict /set_bc_color undef
   /Popup {
     dup /Open oknown {
       dup /Open get {
-        dup /AP oknown {
+        //ValidateAP exec
+        {
           //true
-        }{
+        } {
           gsave
           //startannottransparency exec
           newpath
@@ -4624,7 +4638,8 @@ currentdict /set_bc_color undef
     %% until the content is removed, before that the content should be present and
     %% I beleive we should print it. So take no action for Redact annotations if they
     %% have no appearance.
-    dup /AP oknown {
+    //ValidateAP exec
+    {
       //true
     } {
       //false
@@ -4633,6 +4648,7 @@ currentdict /set_bc_color undef
 
 currentdict /startannottransparency undef
 currentdict /endannottransparency undef
+currentdict /ValidateAP undef
 currentdict /quadpoints2basis undef
 currentdict /drawellipse undef
 currentdict end readonly def
diff --git a/Master/tlpkg/tlgs/Resource/Init/pdf_font.ps b/Master/tlpkg/tlgs/Resource/Init/pdf_font.ps
index feaf0d036ac..bea9ea95ad1 100644
--- a/Master/tlpkg/tlgs/Resource/Init/pdf_font.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/pdf_font.ps
@@ -718,7 +718,7 @@ currentdict end readonly def
   {pop pop pop}
   ifelse
 
-} bind executeonly def
+} bind executeonly odef
 
 currentdict /.DoToUnicode? .forceundef
 
@@ -1179,8 +1179,16 @@ currentdict /eexec_pdf_param_dict .undef
     /CharProcs 1 index /CharProcs oget def
     1 index /Widths knownoget {
       /Widths exch def
-      /FirstChar 1 index /FirstChar oget def
-      /LastChar 1 index /LastChar oget def
+      1 index /FirstChar known 2 index /LastChar known and {
+        /FirstChar 1 index /FirstChar oget def
+        /LastChar 1 index /LastChar oget def
+      } {
+       (   **** Error: Requireed entry FirstChar or LastChar is missing from Font.\n)
+       pdfformaterror
+       (               Output may be incorrect.\n) pdfformaterror
+        /FirstChar 0 def
+        /LastChar Widths length def
+      }ifelse
     } if
     /FontName 1 index /Name knownoget not { /PDFType3Untitled } if def
     /Encoding .notdefEncoding 2 index getencoding def
@@ -1241,7 +1249,7 @@ currentdict /eexec_pdf_param_dict .undef
     } bdef
     dup currentdict Encoding .processToUnicode
     currentdict end .completefont exch pop
-} bind executeonly def
+} bind executeonly odef
 /.adjustcharwidth {	% <wx> <wy> .adjustcharwidth <wx'> <wy'>
   % Enforce the metrics, in glyph space, to the values found in the PDF Font object
   % - force wy == 0 (assumed, and not stored in the PDF font)
@@ -1475,6 +1483,16 @@ currentdict end readonly def
   //CMap_read_dict begin
   /CIDInit /ProcSet findresource begin
   12 dict begin
+  /o.endmapvalue /.endmapvalue load def
+  /.endmapvalue
+  {
+    dup 65535 gt
+    {
+      (   **** Warning: CMap: CID out of valid range (0-65535).\n)  pdfformatwarning
+      pop 65535
+    } if
+    o.endmapvalue
+  } bind def
   4 2 roll
   dup //null eq { pop } { /WMode exch def } ifelse
   dup //null eq { pop } { /CIDSystemInfo exch def } ifelse
@@ -1482,6 +1500,7 @@ currentdict end readonly def
   /.last_CMap_def currentdict def % establish binding
   mark exch % emulate 'begincodespacerange'
   0 (endcmap) /SubFileDecode filter cvx /begincmap cvx exch 2 .execn
+  currentdict /o.endmapvalue undef
   endcmap
   /.last_CMap_def load
   { currentdict end //CMap_read_dict eq { exit } if } loop
@@ -1849,8 +1868,16 @@ currentdict /CMap_read_dict undef
 /findCIDFont {
   {
     dup /CIDFont resourcestatus {
-      pop pop /CIDFont findresource
-      exit
+      pop %size
+      % Check status. If its 1 then we loaded this CIDFont resource from disk, and
+      % its safe to use it. If its 0 then it was loaded from the PDF file and its
+      % *not* safe to use as a replacement for a missing font. If its 2 then its
+      % not loaded, but is available from external resource and is safe to use. So
+      % if status is 0, *don't* use this CIDFont.
+      0 eq not {
+        /CIDFont findresource
+        exit
+      }if
     } if
     .remove_font_name_prefix
     dup dup length string cvs
@@ -2026,7 +2053,7 @@ currentdict /CMap_read_dict undef
     } if
     /findresource cvx /undefined signalerror
   } loop
-} bind executeonly def
+} bind executeonly odef
 
 /buildCIDType0 {	% <CIDFontType0-font-resource> buildCIDType0 <font>
   dup /BaseFont get findCIDFont exch pop
@@ -2211,7 +2238,7 @@ currentdict /CMap_read_dict undef
   /Type0 //buildType0
   /Type1 //buildType1
   /MMType1 //buildType1
-  /Type3 //buildType3
+  /Type3 /buildType3 load
   /TrueType //buildTrueType
   /CIDFontType0 //buildCIDType0
   /CIDFontType2 //buildCIDType2
@@ -2521,6 +2548,7 @@ drawopdict begin
       pop pop pop pop
       //d0 exec
     } {
+      currentcolor currentcolorspace .swapcolors setcolorspace setcolor .swapcolors
       6 -2 roll .adjustcharwidth 6 2 roll setcachedevice
     } ifelse
   } bind executeonly def
diff --git a/Master/tlpkg/tlgs/Resource/Init/pdf_main.ps b/Master/tlpkg/tlgs/Resource/Init/pdf_main.ps
index 09f87353c20..00da47a4871 100644
--- a/Master/tlpkg/tlgs/Resource/Init/pdf_main.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/pdf_main.ps
@@ -660,7 +660,7 @@ currentdict /runpdfstring .undef
     } forall
     pop
   } ifelse
-} bind executeonly def
+} bind executeonly odef
 
 currentdict /pdf_collection_files .undef
 
@@ -1952,22 +1952,30 @@ currentdict /xref-char-dict undef
   Trailer /Root knownoget {
     /Pages knownoget {
       10 dict begin
+      /Count pdfpagecount def
       /verify_page_tree_recursive {
-        dup 1 def
-        dup /Kids knownoget {
-          { oforce
-            dup //null ne {
-              currentdict 1 index known {
-                (   **** Error: there's a loop in the Pages tree. Giving up.\n) pdfformaterror
-                /verify_page_tree cvx /syntaxerror signalerror
-              } if
-              verify_page_tree_recursive
-            } {
-              pop
-            } ifelse
-          } forall
-        } if
-        currentdict exch undef
+        Count 0 gt {
+          dup 1 def
+          dup /Kids knownoget {
+            { oforce
+              dup //null ne {
+                currentdict 1 index known {
+                  (   **** Error: there's a loop in the Pages tree. Giving up.\n) pdfformaterror
+                  /verify_page_tree cvx /syntaxerror signalerror
+                } if
+                verify_page_tree_recursive
+              } {
+                pop
+              } ifelse
+            } forall
+          } {
+            /Count Count 1 sub def
+          }ifelse
+          currentdict exch undef
+          } {
+            pop
+            (   **** Error: Too many pages in Page tree.\n) pdfformaterror
+        } ifelse
       } def
       verify_page_tree_recursive
       end
@@ -2631,10 +2639,9 @@ currentdict /PDF2PS_matrix_key undef
         % (eg GSView 5) then it will not be present, so we must rescan.
   currentpagedevice /PageUsesTransparency .knownget not {dup pageusestransparency} if
   dup /PDFusingtransparency exch def {
-    % If the current device isn't ProcessColorModel /DeviceCMYK, or if it is a
-    % HighLevelDevice (pdfwrite) we don't need the special handling of Overprint
-    % transparency, so disable the checking.
-    currentpagedevice dup /ProcessColorModel get /DeviceCMYK ne exch /HighLevelDevice known or {
+    % If the current device isn't CMYK, or if it is a HighLevelDevice (pdfwrite) we
+    % don't need the special handling of Overprint transparency, so disable the checking.
+    currentpagedevice dup /Colors get 4 lt exch /HighLevelDevice known or {
       /checkOPtrans { pop false } def	% NB: original will be restored from PDFsave
     } if
     % Show the page within a PDF 1.4 device filter.
@@ -2715,13 +2722,34 @@ currentdict /PDF2PS_matrix_key undef
   .setglobal
   /RepairedAnError exch def
   /Repaired exch def
-} bind executeonly def
+} bind executeonly odef
 
 % Display the contents of a page (including annotations).
 /showpagecontents {	% <pagedict> showpagecontents -
   dup		% Save the pagedict for the Annotations
+
+  % We do a 'save' here in order to allow us to restore at the end of the page, before
+  % we run the annotations. There are two reasons for this; firstly so that the graphics state
+  % at the time we run the annotations is the same as when we ran the page, secondly in order
+  % to empty the font cache before we run the annotations.
+  %
+  % Bug #700096 an annotation uses Helvetica but doesn't embed it, however the page *does*
+  % use an embedded Helvetica, which is subset and not prefixed as such. For this file to
+  % render correctly we must not use the font from the page, but must find a replacement.
+  % However the file for Bug #695897 has a page which uses two versions of the same font,
+  % one embedded, one not. In order for *that* file to render correctly we *must* use the
+  % embedded font as a substitute for the missing font. So we divorce the fonts used
+  % for the page from the fonts used for Annotations, this allows both files to work as
+  % expected.
+  %
+  % We also need a countdictstack, so that we can check the dictionaries on the dictioanry
+  % stack after we run the page contents, and 'end' an extra ones before we try to restore
+  % otherwise we might try to restore back to a point before one of those dictionaries existed.
+  %
+  save
+  countdictstack
+  3 -1 roll
   count 1 sub  /pdfemptycount exch store
-  /pdfemptycount where pop /annot_gstate gstate currentgstate put	% preserve gstate for Annots later
   /Contents knownoget not { 0 array } if
   dup type /arraytype ne { 1 array astore } if {
     oforce dup type /dicttype eq {
@@ -2741,7 +2769,21 @@ currentdict /PDF2PS_matrix_key undef
   } {
     pop
   } ifelse
-  annot_gstate setgstate	% restore the gstate for Annots
+
+  % Top of the stack should ow be the count of dictionaries on the stack at the time
+  % we did a save. If there are more than there were then, end dictionaries until
+  % we get back to the sme number.
+  {
+    countdictstack 1 index le {exit}if
+    end
+  } loop
+  % discard the count of dictionaries
+  pop
+  % and restore the state. This will take us back to a point before any fonts
+  % used on the page were defined, so the annotations won't inherit any of
+  % them.
+  restore
+
   % Draw the annotations
   //systemdict /ShowAnnots .knownget not { //true } if {
     /Annots knownoget {
diff --git a/Master/tlpkg/tlgs/Resource/Init/pdf_ops.ps b/Master/tlpkg/tlgs/Resource/Init/pdf_ops.ps
index c45fc519be5..8672d617f36 100644
--- a/Master/tlpkg/tlgs/Resource/Init/pdf_ops.ps
+++ b/Master/tlpkg/tlgs/Resource/Init/pdf_ops.ps
@@ -193,7 +193,7 @@ currentdict /gput_always_allow .undef
       pdfformaterror
     } ifelse
   } if
-} bind executeonly def
+} bind executeonly odef
 
 % Save PDF gstate
 /qstate {       % - qstate <qstate>
@@ -451,7 +451,7 @@ currentdict /gput_always_allow .undef
   %% a gsave, so we haven't copied it to /self, if we don't do that here
   %% then transparent annotations cause an invalid access error.
   currentdict //nodict eq {/self dup load end 5 dict begin def} if
-} bind executeonly def
+} bind executeonly odef
 /AIS { .setalphaisshape } bind executeonly def
 /BM {
   /.setblendmode where {
@@ -1077,7 +1077,7 @@ end readonly def
     pdfopdict /v {inside_text_v} bind .forceput
     pdfopdict /y {inside_text_y} bind .forceput
     pdfopdict /re {inside_text_re} bind .forceput
-} bind executeonly def
+} bind executeonly odef
 
 /switch_to_normal_marking_ops {
     pdfopdict /m {normal_m} bind .forceput
@@ -1086,7 +1086,7 @@ end readonly def
     pdfopdict /v {normal_v} bind .forceput
     pdfopdict /y {normal_y} bind .forceput
     pdfopdict /re {normal_re} bind .forceput
-} bind executeonly def
+} bind executeonly odef
 
 /BT {
   currentdict /TextSaveMatrix known {